CVE-2023-22601
published 2023-01-12CVE-2023-22601: InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Use…
PriorityP345high8.6CVSS 3.1
AVNACLPRNUINSCCHINAN
EPSS
0.56%
42.5th percentile
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Use of Insufficiently Random Values. They do not properly randomize MQTT ClientID parameters. An unauthorized user could calculate this parameter and use it to gather additional information about other InHand devices managed on the same cloud platform.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| inhand_networks | inrouter_302 | < IR302 V3.5.56 | IR302 V3.5.56 |
| inhand_networks | inrouter_615 | < InRouter6XX-S-V2.3.0.r5542 | InRouter6XX-S-V2.3.0.r5542 |
| inhandnetworks | inrouter302_firmware | < 3.5.56 | 3.5.56 |
| inhandnetworks | inrouter615-s_firmware | < 2.3.0.r5542 | 2.3.0.r5542 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
InHand Networks InRouter
cisa_ics·2023-01-13·CVSS 6.5
[MEDIUM] InHand Networks InRouter
ICS Advisory
##
InHand Networks InRouter
Last RevisedJanuary 13, 2023
Alert CodeICSA-23-012-03
## 1. EXECUTIVE SUMMARY
- CVSS v3 10.0
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: InHand Networks
- Equipment: InRouter302, InRouter615
- Vulnerabilities: Cleartext Transmission of Sensitive Information, OS Command Injection, Use of a One-way Hash with a Predictable Salt, Improper Access Control, Use of Insufficiently Random Values
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow a message queuing telemetry transport (MQTT) command injection, unauthorized disclosure of sensitive device information, and remote code execution. If properly chained, these vulnerabilities could result in an unauthorized remote us
GHSA
GHSA-8rgq-7c98-wxpm: InHand Networks InRouter 302, prior to version IR302 V3
ghsa_unreviewed·2023-01-13
CVE-2023-22601 [HIGH] CWE-330 GHSA-8rgq-7c98-wxpm: InHand Networks InRouter 302, prior to version IR302 V3
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Use of Insufficiently Random Values. They do not properly randomize MQTT ClientID parameters. An unauthorized user could calculate this parameter and use it to gather additional information about other InHand devices managed on the same cloud platform.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-01-12
Published